Unscored CVE-2008-3102 EUVD-2008-3092GHSA-gf43-jcc9-q7jf

Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cau…

Published Sep 24, 2008 · Updated Aug 7, 2024 · Assigned by mitre

Description

Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

References

31344 vdb-entry
32243 third-party-advisory
FEDORA-2008-9015 vendor-advisory
4298 third-party-advisory
20080923 mantis CVE-2008-3102 (Re: menalto gallery: Session hijacking vulnerability, CVE-2008-3102) mailing-list
32975 third-party-advisory
GLSA-200812-07 vendor-advisory
32330 third-party-advisory
mantis-cookie-session-hijacking(45395) vdb-entry
FEDORA-2008-8925 vendor-advisory
20080922 menalto gallery: Session hijacking vulnerability, CVE-2008-3102 mailing-list
http://int21.de/cve/CVE-2008-3102-mantis.html